CVE-2026-86830

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

State: Published
Severity: 8.6 High
Published: Sep 14, 2026
Updated: Oct 20, 2026
Reserved: Sep 8, 2026

Description

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment.

This issue has been addressed in TEAM version 1.5.1 or later. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	AMZN

Weaknesses

CWE-266 Incorrect privilege assignment
CWE-1220 Insufficient granularity of access control

Affected Products

Product	Versions
iam-identity-center-teamAWS	before 1.5.1Affected

References

https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.5.1release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-112-aws/vendor-advisory
https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-6x87-mjv8-mgvjrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.